A worm must reach an infection threshold to successfully conduct a DoS attack, said Kuo, and Mydoom.b just didn't make it. "If a worm's not managed to get out there, to reach that magic threshold, it's very, very difficult for it to spread."
According to Network Associates' estimates, only about 10,000 machines worldwide have been infected with the Mydoom.b worm. Compare that to the 500,000 machines infected with the original Mydoom.a, which didn't target Microsoft.com, and it's easy to see why the Redmond, Wash.-based developer's Web sites remained up and running.
But numbers don't tell the whole story, said Kuo.
Both Mydoom.a and Mydoom.b have a programming error that limits the number of infected machines which will conduct the DoS attacks at the same time.
Only about seven percent of the Mydoom.b-compromised computers actually attack Microsoft.com simultaneously, according to Network Associates' analysis, said Kuo. (Mydoom.a also sports the same bug, but in its case, about 25 percent of the infected machines are able to attack The SCO Group's site at the same time.)